In the MITRE ATT&CK framework, what does the acronym TTP stand for?

• A. Tactics, Techniques, and Procedures
• B. Tools, Techniques, and Protocols
• C. Threat, Tactics, and Procedures
• D. Techniques, Tactics, and Protocols

Answer: (A)

The concept being tested is how TTP is used to describe attacker behavior in MITRE ATT&CK. Tactics are the high-level goals attackers try to achieve, techniques are the concrete methods used to reach those goals, and procedures are the specific, real-world steps an adversary follows to carry out a technique. Therefore, TTP stands for Tactics, Techniques, and Procedures. This order reflects the progression from overall aims to concrete methods to exact operations, which is why it’s the canonical expansion in ATT&CK. The other options mix in terms not used in the standard acronym (like Tools or Protocols) or swap the order, which isn’t how the framework is defined.